CVE-2025-1674: Out-of-bounds Read in zephyrproject-rtos Zephyr

This vulnerability in Zephyr OS arises from a lack of input validation that permits out-of-bounds memory reads when processing certain packets. Such out-of-bounds reads can lead to application crashes, impacting system availability. The flaw affects versions before 3.7.2 and versions 4.0.0 through 4.0.x, but not 4.1.0 or later. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality impact but high availability impact.

An attacker can cause the affected Zephyr OS system to crash by sending malicious or malformed packets that trigger out-of-bounds reads. This results in denial of service, affecting system availability. There is no indication of confidentiality or integrity compromise. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposure of vulnerable Zephyr OS instances to untrusted networks or inputs that could trigger malformed packets.